CVE-2012-6427

Опубликовано: 23 дек. 2012

Источник: nvd

CVSS2: 7.8

CVSS2: 7.5

EPSS Низкий

Описание

The Carlo Gavazzi EOS-Box

does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.

Ссылки

https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02
http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-02.pdf
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:carlosgavazzi:eos-box_photovoltaic_monitoring_system_firmware:*:*:*:*:*:*:*:*

Версия до 1.0.0 (включая)

cpe:2.3:h:carlosgavazzi:eos-box_photovoltaic_monitoring_system:-:*:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.00238

Низкий

7.8 High

CVSS2

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-7qc4-45cg-h6f3

github

больше 3 лет назад

Multiple SQL injection vulnerabilities in Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, a similar issue to CVE-2012-5861.

EPSS

Процентиль: 47%

0.00238

Низкий

7.8 High

CVSS2

7.5 High

CVSS2

Дефекты

CWE-89